Why Leaders Are High-Value Targets

Reading time ~11 minutes · No technical prerequisites · Day 1, Module 1.3

The previous two lessons established that you are in persistent contact with capable adversaries and that you must consume intelligence about them critically. This lesson makes the threat personal. The most senior box on your org chart is also, very often, the softest and most information-rich target in the organisation. Understanding why is the first step to changing it.

Your risk signature: authority, access, trust, visibility

Four attributes make a leader uniquely valuable to an adversary. Authority: your decisions move money, people, and priorities, so impersonating you is worth more than impersonating anyone else. Access: you can reach information and systems that others cannot. Trust: people act on a message that appears to come from you without the scrutiny they would apply to a stranger. Visibility: your role, your movements, and your relationships are partly public by the nature of the job. Each of these is an asset to you — and each is, from the adversary's seat, an asset to them.

Business-email compromise at the decision level

Ordinary business-email compromise steals a payment by redirecting an invoice. Executive impersonation aims higher: it steals a decision. An emergency authorisation, a sudden supplier change, a "handle this quietly and don't copy the others" instruction to a subordinate who will not push back against the boss. The crucial asymmetry is that the adversary does not need your password to exploit your authority. They need your voice — your tone, your timing, and your relationships — which they can reconstruct from public material and from a compromised person near you.

The aggregation problem

The single most important idea in this lesson is aggregation. No individual fragment about you is secret or sensitive on its own. Your public bio, the recurring pattern of your assistant's "out of office while travelling with the Director" posts, a conference badge photo, a leaked supplier invoice — each is harmless in isolation. Combined, they tell an adversary precisely when you travel, who arranges it, and which supplier can credibly email you at that moment. The targeting picture is assembled from pieces no one would think to protect, which is exactly why it works.

Each fragment is "harmless." The aggregate tells an adversary exactly when you move, through whom, and how to reach you convincingly.

The indirect path: trust chains

Adversaries rarely attack the principal directly. They attack the path to the principal, because every person in that path is a softer target than you and each has a legitimate reason to be in contact. A scheduler, an executive assistant, a trusted supplier — compromise any one and the adversary gains a credible channel straight to you. This is why your own hardening, though necessary, is never sufficient. If the people around you are soft, you are soft. The trust chain is the real attack surface, and it is a leadership responsibility to harden it, not just your own devices.

OSINT and relationship mapping

Open-source intelligence collection is cheap, legal, and patient. Professional networks expose your org chart and identify your assistants. Social posts reveal your travel, your routines, your grievances, and your mood. Procurement records reveal which suppliers can plausibly email you about an invoice or a delivery. From these, an adversary builds a relationship map and looks for the softest, best-positioned node to approach. This is not hypothetical: hostile services mapped and targeted senior officials and their personal networks in exactly this way throughout the Russia–Ukraine war, reaching principals through the people and patterns around them.

What to do about it

Three responses follow directly, and each is developed in later lessons. First, shrink the footprint — reduce the public patterns, not merely the facts, because patterns and timing are more weaponisable than static details. Second, harden the chain — extend the same discipline you adopt to your assistants and key suppliers, since they are the indirect path. Third, assume impersonation — build out-of-band verification habits before you need them, so that a convincing message in your name does not automatically become an action.